# Clause 9.3.3: Management review outputs

The review must lead to decisions on chances for continual improvement and on any changes that would make the BCMS more efficient and effective. These cover changes to scope; updates to the business impact analysis, the risk assessment, the strategies, the solutions and the plans; changes to procedures and controls so they respond to internal or external issues; and the way control effectiveness is to be measured. Keep documented evidence of the outcome, tell the relevant interested parties about it, and act on it as appropriate.

Cloud: Outputs should assign the work that closes the gaps: a contract change, a second region, a test, a budget line. An output without an owner and a date is a minute, not a decision.

Evidence: Minutes recording decisions against each required output area; Actions with owners and dates traceable from the decisions; Communication records to relevant interested parties; Evidence of the resulting change in the BCMS artefacts.

Test: Check every review output has an owner and a due date.

Citation: ISO 22301:2019, clause 9.3.3. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.